CVE-2025-38644

What it actually does

The flaw allows TDLS operations (such as NL80211_TDLS_ENABLE_LINK) to be processed before a station has completed association in station mode, leaving internal state like sdata->u.mgd.tdls_peer uninitialized and triggering WARN_ON() in subsequent code paths that assume valid state.

Why it matters to the business

Systems running affected Linux kernels with Wi-Fi support can experience kernel warnings, instability, or crashes triggered by malformed or premature wireless commands, increasing operational risk across 441 downstream dependents with remediation urgency driven by listed threat actor campaigns.

How an attack unfolds

An attacker sends NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT but before association completes and without prior TDLS setup, exploiting the missing validation to reach uninitialized state and trigger the warning condition; threat actors including Advanced Spyware Campaign and 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors have targeted similar Linux kernel issues.

How to fix it

Upgrade to Linux kernel commit 0c84204cf0bbe89e454a5caccc6a908bc7db1542 or later; for listed packages apply the fixed versions such as redis 5:7.0.15-1~deb12u5 where applicable and rebuild or reboot affected systems.

How to confirm the fix worked

Confirm the kernel contains commit 0c84204cf0bbe89e454a5caccc6a908bc7db1542, verify that ieee80211_tdls_oper() now rejects operations when not in station mode or not associated, and test by attempting premature TDLS commands without triggering warnings.

Typical attack path

1. Establish a Wi-Fi interface in station mode
2. Issue NL80211_CMD_CONNECT without waiting for association
3. Immediately send NL80211_TDLS_ENABLE_LINK
4. Trigger code paths that dereference uninitialized tdls_peer state
5. Cause WARN_ON() and potential system instability

How to detect it

Search kernel logs for WARN_ON messages originating from ieee80211_tdls_oper or related mac80211 TDLS state handling; correlate with wireless association events and look for sequences of NL80211 commands that precede association completion; examine threat actor patterns from Advanced Spyware Campaign and 2024 Zero-Day Exploitation Campaigns.

What your security team should do

• Prioritize patching Linux kernel Wi-Fi components within CISA timelines if applicable
• Monitor for related privilege escalation activity from listed threat actors
• Apply exact fixed versions to all 441 downstream dependents
• Harden wireless configuration to require full association before TDLS
• Review logs for ieee80211_tdls_oper warnings